Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-114114 | medium | 5.3 | No | Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset valu... | 2026-10-28 |
| CVE-2026-114109 | high | 8.8 | No | uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via craf... | 2026-10-28 |
| CVE-2026-114104 | medium | 5.9 | No | adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying... | 2026-10-28 |
| CVE-2026-114099 | medium | 5.8 | No | Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping... | 2026-10-28 |
| CVE-2026-113793 | not reported | — | No | pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, removing an object from a crafted cyclic PDF tree, such as an outl... | 2026-10-28 |
| CVE-2026-113789 | not reported | — | No | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long... | 2026-10-28 |
| CVE-2026-113744 | critical | 10.0 | No | A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /g... | 2026-10-28 |
| CVE-2026-113721 | medium | 4.5 | No | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator._generate() removes an existi... | 2026-10-28 |
| CVE-2026-112353 | high | 8.2 | No | GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that al... | 2026-10-28 |
| CVE-2026-112352 | critical | 9.1 | No | Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate... | 2026-10-28 |
| CVE-2026-111758 | high | 7.5 | No | markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose labe... | 2026-10-28 |
| CVE-2026-111255 | high | 7.5 | No | The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all... | 2026-10-28 |
| CVE-2026-109999 | high | 7.2 | No | The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin f... | 2026-10-28 |
| CVE-2026-109972 | medium | 6.4 | No | The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vu... | 2026-10-28 |
| CVE-2026-109381 | high | 7.2 | No | The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the me... | 2026-10-28 |
| CVE-2026-109236 | medium | 4.8 | No | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verifica... | 2026-10-28 |
| CVE-2026-106079 | high | 8.8 | No | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Netw... | 2026-10-28 |
| CVE-2026-107625 | medium | 6.4 | No | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v... | 2026-10-28 |
| CVE-2026-104354 | critical | 9.1 | No | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerab... | 2026-10-28 |
| CVE-2026-103996 | medium | 6.4 | No | The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting... | 2026-10-28 |